@blamejs/pki 0.3.17 → 0.3.19

package/lib/pki-build.js

@@ -15,10 +15,16 @@ var schema = require("./schema-engine");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
 var oid = require("./oid");
+var ipUtils = require("./ip-utils");
 var nodeCrypto = require("crypto");
 
 var b = asn1.build;
 
+// A well-formed dotted-decimal OID: a first arc 0-2 followed by one or more non-leading-zero arcs. Used to
+// accept a raw OID string (an unregistered KeyPurposeId / policy OID) where a registered name would go; the
+// encoder (encodeOidContent) remains the authoritative validator of the arc-value bounds.
+var DOTTED_OID_RE = /^[0-2](?:\.(?:0|[1-9]\d*))+$/;
+
 // KeyUsage named-bit positions (RFC 5280 sec. 4.2.1.3); contentCommitment is the RFC 5280 rename of the
 // X.509 nonRepudiation bit (1).
 var KU_BIT = {
@@ -112,8 +118,16 @@ function makeBuilder(ctx) {
       case "dNSName": return b.contextPrimitive(2, ia5Content(v));
       case "uniformResourceIdentifier": case "uri": return b.contextPrimitive(6, ia5Content(v));
       case "iPAddress":
-        if (!Buffer.isBuffer(v) || (v.length !== 4 && v.length !== 16)) throw E("bad-input", "iPAddress must be a 4- or 16-octet Buffer");
-        return b.contextPrimitive(7, v);
+        // Accept a dotted-quad / colon-hex string (packed to its 4/16 network octets) as well as a
+        // pre-packed Buffer, so an iPAddress SAN reads like dNSName/URI rather than forcing the caller
+        // to pack octets by hand (RFC 5280 sec. 4.2.1.6 -- a GeneralName iPAddress is a bare host address).
+        var ipBuf = v;
+        if (typeof v === "string") {
+          ipBuf = ipUtils.packIpLiteral(v);
+          if (ipBuf === null) throw E("bad-input", "iPAddress string is not a valid IPv4 or IPv6 literal: " + JSON.stringify(v));
+        }
+        if (!Buffer.isBuffer(ipBuf) || (ipBuf.length !== 4 && ipBuf.length !== 16)) throw E("bad-input", "iPAddress must be a 4- or 16-octet Buffer or an IPv4/IPv6 string");
+        return b.contextPrimitive(7, ipBuf);
       case "directoryName": return b.explicit(4, encodeName(v));   // Name is a CHOICE -> the context tag is EXPLICIT
       default: throw E("bad-input", "unsupported GeneralName form " + JSON.stringify(k) + " (supported: rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, directoryName)");
     }
@@ -129,13 +143,26 @@ function makeBuilder(ctx) {
     });
     return b.namedBitString(positions);
   }
+  // Resolve an OID token to a dotted-decimal OID: a registered name via the registry, OR a raw dotted-OID
+  // string accepted directly (an unregistered KeyPurposeId / policy OID -- BIMI, document-signing, vendor
+  // purposes -- is a common valid input). A token that is neither fails closed (never silently accept a
+  // typo'd name); a dotted string that passes the shape check is still arc-validated by b.oid's encoder.
+  function _resolveOid(n, label) {
+    var dotted = O(n);
+    if (dotted != null) return dotted;
+    if (typeof n === "string" && DOTTED_OID_RE.test(n)) {
+      // The regex fixes the general shape; b.oid's encoder is the authoritative X.660 arc-bounds check
+      // (a first arc 0/1 caps the second at 39; an arc must DER-encode). A failure there is THIS producer's
+      // bad-input, not a leaked oid/* code, so every shared-builder consumer keeps its own error contract.
+      try { b.oid(n); }
+      catch (e) { throw E("bad-input", "invalid " + label + " OID " + JSON.stringify(n) + " (violates the X.660 arc bounds)", e); }
+      return n;
+    }
+    throw E("bad-input", "unknown " + label + " " + JSON.stringify(n) + " (expected a registered name or a dotted-decimal OID)");
+  }
   function extExtKeyUsage(names) {
     if (!Array.isArray(names) || !names.length) throw E("bad-input", "extendedKeyUsage must list at least one KeyPurposeId");
-    return b.sequence(names.map(function (n) {
-      var purposeOid = O(n);
-      if (purposeOid == null) throw E("bad-input", "unknown extendedKeyUsage purpose " + JSON.stringify(n));
-      return b.oid(purposeOid);
-    }));
+    return b.sequence(names.map(function (n) { return b.oid(_resolveOid(n, "extendedKeyUsage purpose")); }));
   }
   function validateBcSpec(bc) {
     if (bc.cA != null && typeof bc.cA !== "boolean") throw E("bad-input", "basicConstraints cA must be a boolean");
@@ -173,8 +200,7 @@ function makeBuilder(ctx) {
     if (!Array.isArray(names) || !names.length) throw E("bad-input", "certificatePolicies must list at least one policy OID");
     var seen = {};
     return b.sequence(names.map(function (n) {
-      var pOid = O(n);
-      if (pOid == null) throw E("bad-input", "unknown certificate policy " + JSON.stringify(n));
+      var pOid = _resolveOid(n, "certificate policy");
       if (seen[pOid]) throw E("bad-input", "duplicate certificate policy " + JSON.stringify(n) + " (RFC 5280 sec. 4.2.1.4)");
       seen[pOid] = true;
       return b.sequence([b.oid(pOid)]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.17",
+  "version": "0.3.19",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:d422e0bf-7707-4f70-8e04-0d467ade9599",
+  "serialNumber": "urn:uuid:5ea5efe8-4feb-403c-ab5c-154dfdb673c4",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-25T04:02:51.828Z",
+    "timestamp": "2026-07-26T02:33:15.202Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.17",
+      "bom-ref": "@blamejs/pki@0.3.19",
       "type": "application",
       "name": "pki",
-      "version": "0.3.17",
+      "version": "0.3.19",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.17",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.19",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.17",
+      "ref": "@blamejs/pki@0.3.19",
       "dependsOn": []
     }
   ]